CVE-2026-11680: Use after free in Media in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in the Media component of Google Chrome on Windows in versions prior to 149.0.7827.103. The flaw is reachable over the network and requires no authentication, but the victim must visit a crafted HTML page. Successful exploitation gives a remote attacker arbitrary code execution inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable or browsable from the public internet or an internal network.

• AuthenticationNot required

  No account or credential of any kind is needed; the attacker only needs the victim to load a page.

• Victim interactionRequired

  The victim must open or be redirected to an attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox on the victim's Windows host.
• Confidentiality impact is high: the attacker can read data accessible to the sandboxed process, including in-page credentials and session tokens.
• Integrity impact is high: the attacker can write or modify data within the sandboxed process, including DOM state and locally cached content.
• Availability impact is high: the attacker can crash or hang the affected Chrome process, disrupting the user's browsing session.